Amavis rejecting all mail from Outlook as UBE

Discussion in 'Server Operation' started by elorc, Aug 7, 2010.

  1. elorc

    elorc New Member

    [Solved] Amavis rejecting all mail from Outlook as UBE

    Another mail issue I just noticed a little while ago (on a server set up using this guide: http://howtoforge.com/virtual-users-domains-postfix-courier-mysql-squirrelmail-ubuntu8.04) is that any email I send from Outlook 2007 is rejected by Amavis as unsolicited bulk email, but anything I send from the Mail application on my Mac works fine.

    Both computers are behind the same router, so they're in the networks I set in the postfix configuration. In my mail.log, I see this:

    Code:
    Aug  7 10:51:43 srv1 amavis[15001]: (15001-08) Blocked SPAM, [11.222.33.444] [11.222.33.444] <[email protected]> -> <[email protected]>, quarantine: M/spam-MrIo8n0UN2TP.gz, Message-ID: <001301cb3658$c96e6bb0$5c4b4310$@org>, mail_id: MrIo8n0UN2TP, Hits: 6.974, size: 3094, 4893 ms
    Aug  7 10:51:43 srv1 postfix/smtp[25628]: 56BC4C848A: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.3, delays=0.39/0.01/0/4.9, dsn=2.5.0, status=sent (250 2.5.0 Ok, id=15001-08, BOUNCE)
    Aug  7 10:51:43 srv1 postfix/qmgr[25531]: 56BC4C848A: removed
    And the message received by the sender from Amavis says this:

    Does Outlook do something weird to trigger Amavis?
     
    Last edited: Aug 12, 2010
  2. Rapid2214

    Rapid2214 New Member

    I have seen that Outlook does not set the message ID correct that is a RFC rule, but this is usally only stopped by spam filters not virus filters.

    To see what i mean send an email from outlook to '[email protected]' with the subject 'TEST' (without quotes), you will receive a reply with 3 mins about the your spam score...


    Thanks

    Marty
     
  3. elorc

    elorc New Member

    I can't send the email from Outlook using this mail server to that address either. I get the same UBE bounced message as when I was trying to email the gmail address. I also can't send email from the Mac Mail client to that address either. Email from the Mac Mail client still reaches the gmail test account though. What the deuce?
     
  4. falko

    falko Super Moderator Howtoforge Staff

    What's the value of myhostname in your amavisd configuration?
     
  5. elorc

    elorc New Member

    Where is that value located? I know where it is for Postfix, but off the top of my head I'm not sure where that is for Amavis.

    Edit: One thing I noticed, is that the mail logs identify my server as "ip-##-###-###-##" (where ##-###-###-##, is it's actual IP address) while the hostname of my server everywhere else is srv1.mydomain.com. This includes my Postfix configuration, and when I run the hostname command. This may relate to my issue with Amavis as well. In the course of making the logs anonymous for posting I didn't really pay attention to it. I just switched the ip-##-###-###-## part to srv1, not even thinking that it could be an indicator of a problem.
     
    Last edited: Aug 8, 2010
  6. falko

    falko Super Moderator Howtoforge Staff

    I guess it'S /etc/aqmavisd.conf or somewhere in the /etc/amavisd.d/ directory.

    Please take a look at /etc/postfix/main.cf and /etc/mailname - do you have the correct hostname there?
     
  7. elorc

    elorc New Member

    Regarding Amavis, I don't have either of those. I do have /etc/amavis. There are two subfolders within it: conf.d and en_US. I don't see a .conf file in any of them. The contents of the folders:

    /etc/amavis/conf.d
    Code:
    -rw-r--r-- 1 root root  1640 2008-03-10 22:21 01-debian
    -rw-r--r-- 1 root root   692 2008-03-10 22:21 05-domain_id
    -rw-r--r-- 1 root root   428 2008-03-10 22:21 05-node_id
    -rw-r--r-- 1 root root 13907 2008-03-10 22:21 15-av_scanners
    -rw-r--r-- 1 root root   550 2010-07-27 10:23 15-content_filter_mode
    -rw-r--r-- 1 root root  9248 2008-03-10 22:21 20-debian_defaults
    -rw-r--r-- 1 root root   573 2008-03-10 22:21 25-amavis_helpers
    -rw-r--r-- 1 root root  2130 2008-03-10 22:21 30-template_localization
    -rw-r--r-- 1 root root   330 2010-07-27 10:24 50-user
    /etc/amavis/en_US
    Code:
    -rw-r--r-- 1 root root  170 2008-03-10 22:21 charset
    -rw-r--r-- 1 root root 4713 2008-03-10 22:21 template-dsn.txt
    -rw-r--r-- 1 root root 1123 2008-03-10 22:21 template-spam-admin.txt
    -rw-r--r-- 1 root root 1524 2008-03-10 22:21 template-spam-sender.txt
    -rw-r--r-- 1 root root 1731 2008-03-10 22:21 template-virus-admin.txt
    -rw-r--r-- 1 root root 1543 2008-03-10 22:21 template-virus-recipient.txt
    -rw-r--r-- 1 root root 3229 2008-03-10 22:21 template-virus-sender.txt
    I tried using find to locate any amavis*.conf file but it returned nothing.

    The hostname is set correctly in /etc/mailname and /etc/postfix/main.cf. They're both set to srv1.mydomain.com, which is what the hostname command returns.

    main.cf
    Code:
    myhostname = srv1.mydomain.com
    myorigin = /etc/mailname
    mydestination = srv1.mydomain.com, localhost, localhost.localdomain
     
  8. Rapid2214

    Rapid2214 New Member

    What does the reject email come back like if at all?

    Like the classic Mail delivery failed: returning message to sender

    :)
     
  9. elorc

    elorc New Member

    It's just the message Amavis generates that I included in the original post. There are two attachments (details and header) to it which more or less reiterate what the main message said. It is designated as a 5.7.0 Reject.

    The details file contains this:

    Code:
    Reporting-MTA: dns; srv1.mydomain.com
    Received-From-MTA: smtp; srv1.mydomain.com ([127.0.0.1])
    Arrival-Date: Sun,  8 Aug 2010 12:06:28 -0700 (MST)
    
    Original-Recipient: rfc822;[email protected]
    Final-Recipient: rfc822;[email protected]
    Action: failed
    Status: 5.7.0
    Diagnostic-Code: smtp; 554 5.7.0 Reject, id=15001-10 - SPAM
    Last-Attempt-Date: Sun,  8 Aug 2010 12:06:28 -0700 (MST)
    Final-Log-ID: 15001-10/0-bQt6XRm-yy
    Header:
    Code:
    Return-Path: <[email protected]>
    Received: from VistaPC (cpe-11-222-33-444.nycap.res.rr.com [11.222.33.444])
    	by srv1.mydomain.com (Postfix) with ESMTP id B8905C848A
    	for <[email protected]>; Sun,  8 Aug 2010 12:06:27 -0700 (MST)
    From: "Me" <[email protected]>
    To: <[email protected]>
    Subject: test 3:04
    Date: Sun, 8 Aug 2010 15:03:20 -0400
    Message-ID: <002901cb372c$5ea37350$1bea59f0$@org>
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    	boundary="----=_NextPart_000_002A_01CB370A.D791D350"
    X-Mailer: Microsoft Office Outlook 12.0
    Thread-Index: Acs3LF46vHa+teEeSpakHNHY2rnW9A==
    Content-Language: en-us
    So weird. :(
     
  10. Rapid2214

    Rapid2214 New Member

    Don't send it via the mail server, to whether its your computer send it directly to that addess.
     
  11. elorc

    elorc New Member

    I'm not sure I understand what you're recommending. If I don't try it via the problem mail server, what mail server should I use and what is it contributing to resolving the issue?
     
  12. falko

    falko Super Moderator Howtoforge Staff

    What does
    Code:
    cd /etc/amavis/conf.d
    grep myhostname *
    show?
     
  13. elorc

    elorc New Member

    This is what I get back:

    Code:
    root@srv1:/etc/amavis/conf.d# grep myhostname *
    05-node_id:# $myhostname is used by amavisd-new for node identification, and it is
    05-node_id:chomp($myhostname = `hostname --fqdn`);
    05-node_id:# To manually set $myhostname, edit the following line with the correct Fully
    05-node_id:#$myhostname = "mail.example.com"
    hostname --fqdn returns:
    Code:
    srv1.mydomain.com
     
  14. falko

    falko Super Moderator Howtoforge Staff

    Please set
    Code:
    $myhostname = "localhost"
    in /etc/amavis/conf.d/05-node_id and restart amavisd.
     
  15. elorc

    elorc New Member

    That did the trick! Thank you!
     

Share This Page